CVE-2025-5630

An attacker can remotely, without any authentication, send a crafted request to the /goform/form2lansetup.cgi endpoint, manipulating the 'ip' argument. Passing an excessively long value leads to a stack-based buffer overflow, which enables overwriting critical memory areas. The vulnerability results from the lack of proper input length validation before copying data into a fixed-size buffer.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code remotely (RCE) on the vulnerable device or cause its instability and unavailability. In the worst-case scenario, the attacker may gain full control over the router.

The D-Link manufacturer no longer issues updates for this model, as the product has reached End of Life status. Immediate replacement with an actively supported model is recommended. As a temporary security measure, isolate the device's administration panel from external network access and restrict access to the management interface only to trusted internal hosts.

D-Link DIR-816 with firmware version 1.10CNB05. Only applies to products that are no longer supported by the manufacturer.